虚机热迁移加密vm live migrate tls

#安装证书生成工具
yum install gnutls-utils

#CA证书生成
certtool --generate-privkey > cakey.pem
[root@test25g05 /home/huiwei]# cat ca.info
cn = Qihoo
ca
cert_signing_key
expiration_days = 700
certtool --generate-self-signed --load-privkey cakey.pem --template ca.info --outfile cacert.pem
#服务端证书生成
certtool --generate-privkey > test25g05_serverkey.pem
[root@test25g05 /home/huiwei]# cat test25g05_server.info
organization = Qihoo
cn = test25g05.ops.lycc.qihoo.net
ip_address = 10.162.97.117
tls_www_server
encryption_key
signing_key
expiration_days = 700
certtool --generate-certificate --load-privkey test25g05_serverkey.pem \
--load-ca-certificate cacert.pem --load-ca-privkey cakey.pem \
--template test25g05_server.info --outfile test25g05_servercert.pem

#客户端证书
certtool --generate-privkey > test25g05_clientkey.pem

[root@test25g05 /home/huiwei]# cat test25g05_client.info
country = CN
state = BJ
locality = BJ
organization = Qihoo
cn = test25g05.ops.lycc.qihoo.net
tls_www_server
encryption_key
signing_key
expiration_days = 700

certtool --generate-certificate --load-privkey test25g05_clientkey.pem \
--load-ca-certificate cacert.pem --load-ca-privkey cakey.pem \
--template test25g05_client.info --outfile test25g05_clientcert.pem
#证书分发
cp cacert.pem /etc/pki/CA/
chmod 444 /etc/pki/CA/cacert.pem
restorecon /etc/pki/CA/cacert.pem
mkdir -p /etc/pki/libvirt
mkdir -p /etc/pki/libvirt/private
chmod 755 /etc/pki/libvirt
chmod 750 /etc/pki/libvirt/private
cp -f test25g05_servercert.pem /etc/pki/libvirt/servercert.pem
cp -f test25g05_serverkey.pem /etc/pki/libvirt/private/serverkey.pem
chgrp qemu /etc/pki/libvirt \
/etc/pki/libvirt/servercert.pem \
/etc/pki/libvirt/private \
/etc/pki/libvirt/private/serverkey.pem
chmod 600 /etc/pki/libvirt/servercert.pem /etc/pki/libvirt/private/serverkey.pem
restorecon -R /etc/pki/libvirt /etc/pki/libvirt/private
cp -f test25g05_clientcert.pem /etc/pki/libvirt/clientcert.pem
cp -f test25g05_clientkey.pem /etc/pki/libvirt/private/clientkey.pem
chmod 644 /etc/pki/libvirt/clientcert.pem /etc/pki/libvirt/private/clientkey.pem
restorecon /etc/pki/libvirt/clientcert.pem /etc/pki/libvirt/private/clientkey.pem
 
#修改libvirt的配置，其它保持不变
vim /etc/libvirt/libvirtd.conf
listen_tls = 1
 
配置nova
vim /etc/nova/nova.conf
[libvirt]
live_migration_tunnelled = true

#其它步骤同上，证书多往一个地方放置
#证书分发
mkdir /var/lib/nova/qemu
cp -f cacert.pem /var/lib/nova/qemu/ca-cert.pem
cp -f test25g05_servercert.pem /var/lib/nova/qemu/server-cert.pem
cp -f test25g05_serverkey.pem /var/lib/nova/server-key.pem
cp -f test25g05_clientcert.pem /var/lib/nova/qemu/client-cert.pem
cp -f test25g05_clientkey.pem /var/lib/nova/qemu/client-key.pem
#修改配置
vim /etc/libvirt/qemu.conf
migrate_tls_x509_cert_dir = "/var/lib/nova/qemu"
migrate_tls_x509_verify = 1
#修改nova-compute的配置
vim /etc/nova/nova.conf
[libvirt]
#live_migration_tunnelled = true     //注释或者删除掉用libvirt加密
live_migration_with_native_tls = true